Contents

File System

A majority of the useful information is stored in /private/var2/mobile/
However there is other useful information stored in the keychains and db folders.

iOS uses sqlite and plist files to store information.

/private/var2/mobile

This contains three folders: Applications, Library and Media

Applications contains a series of folders, which contain the data for all of the apps stored on the phone. The name of each app is stored in its iTunesMetadata.plist.

Library contains the most useful information:
- Address Book
- Calendar
- Safari - favorites, open tabs, web history
- Mail - mail is encrypted and therefore requires the keychain to be decrypted before it can be accessed
- SMS - sms.db, which may include deleted SMS messages
- Notes - notes.sqlite, which may include deleted notes
- Voicemail
- Spotlight - Spotlight database may contain text messages that have since been deleted.